Alert Actions

You can set up Alert Actions to trigger once a Fraud Alert is generated. An Alert Actions allow you to:

• Automatically create a block traffic rule for the country prefix that caused the Fraud Alert.
• Send a notification (email and/or webhook) once a Fraud Alert is generated.
• It’s important to note that a Fraud Alert can trigger just a single Alert Action: it is not possible to trigger multiple alert actions for the same Fraud Alert. Check below section Alert Actions evaluation for further details.

As an example, you can set up Alert Actions for Volumetric Changes alerts:

• To receive a notification as soon as a volumetric changes alert is generated for any country
• To receive a notification and automatically block traffic once a volumetric changes alert with a volume greater than 2000 SMS in the last 12 hours is generated for Belize (see screenshot below).

Creating an Alert Action

1. Go to the Alert Actions section and click on the "Add alert action" button.

2. Set up your Alert Action

   • Fraud Alert: Select the Fraud Alert type for the Alert Action you want to set up.
   • Product: Select the product (voice or sms), the alert action will trigger only when such product generates a Fraud Alert of the type you selected.
   • Action Threshold: You can choose to trigger the Alert Action for any alert regardless of its volume. Or you can choose a Fraud Alert volume. For example, you can choose to trigger the Alert Action only when there is a Volumetric Changes alert showing a traffic volume greater than or equal to 1500 SMS in the last 12 hours.
   • Time Interval: The time interval allows you to suppress triggering an Alert Action for consecutive alerts for the same country. Once a certain Alert Action triggers it won’t trigger again unless the time interval has passed. The time interval is considered on a per-country basis: actions won’t trigger only if the consecutive alerts happen for the same country.
   • Actions: If you choose the "Block" option, as soon as the Alert Action triggers, a block traffic rule will automatically be created for the country prefix that generated the alert (unless there are conflicting rules or a rule has already been created). The "Review" option allows you to create a block rule with a single click from the Fraud Alerts section or decide not to block (if the alert was caused by legitimated activity).
   • Send Fraud Alert Notification: When marking the checkbox, a notification will be sent to you (email and/or webhook).
   • Country: You can choose to trigger the Alert Action regardless of the country that generated the Fraud Alert. Or you can choose to trigger when the fraud alerts are generated by specific country(ies) prefixes.

Alert Actions evaluation

A given Fraud Alert can trigger only a single Alert Action, is it not possible to trigger multiple alert actions for the same Fraud Alert. Check below decision logic for when a Fraud Alert potentially matches multiple Alert Actions.

Country specific vs. “All Countries”

When there is an alert action set up for the country, alert actions with value “All countries” are ignored. In the example below the first alert action will never trigger for Poland.

Multiple Action thresholds for the same Fraud Alert

The Alert Action with the highest volume will be triggered as long as the Fraud Alert reaches the volume. In the example below:

• Volumetric Changes Fraud Alerts (VCFA) for Poland with volume 5000 or greater would trigger the second Alert Action
• VCFA for Poland with volume greater than 2500 and lower than 5000 would trigger the first Alert action
• VCFA for Poland with volume lower than 2500 won’t trigger any alert action
• VCFA for any country except Poland with volume 1000 or greater will trigger the third Alert action